Webmin is a web-based interface for system administration for Linux/UNIX. Using any browser that supports tables and forms (and Java for the File Manager module) you can setup user accounts, Apache, DNS, file sharing and so on. A security vulnerability in the product allows remote attackers to cause the execution of arbitrary commands and read any files on the system (with root permissions).

Credit:
The information has been provided by Noam Rathaus of SecurITeam.

Technical details:
The CGI that handles remote_foreign_require and remote_foreign_call requests from other Webmin servers contains inadequate permission checks.
Access to the CGI is determined by the 'rpc' value in the /usr/libexec/webmin/defaultacl. This value can be '1' or '2'. If '2' is set, only the 'admin' user, or root are allowed access. Otherwise, anyone is allowed to access the CGI. Access to this CGI would allow an attacker any of the following functions:

Utilizing the 'read' and 'write' actions a remote attacker can read or write to any file that is present on the system. This specifically includes /etc/passwd and /etc/shadow. Access to any file is possible because the Webmin server runs as root, and does not drop privileges prior to running those two functions. Unitizing the 'eval' function, it is possible to cause the execution of arbitrary commands with root privileges.

Because of the way the RPC communication is done, the attached exploit code is needed in order to perform the above actions.

Impact:
Since in many Webmin installations the Webmin admin is a non-root user, by exploiting the vulnerability an attacker is able to gain root privileges and compromise the machine.

Workaround:
Modify the defaultacl file to:rpc=0

This is a non-valid solution for organizations handling multiple Webmin servers from a centralized one (remote control usage).

NOTE: This of course does not prevent the vulnerability, but rather disables some functionality to stop it from working.

Perquisite:
Since access to the CGI is required, valid authentication is required.

Vendor response:
The vendor has responded with the following statement:That's not really a bug, because in standard webmin installs the 'admin' or 'root' use has access to all modules with all privileges, which is equivalent to having a root login. However, if on your client's systems the 'admin' user has lesser privileges then it would be a security problem, and I think a release to tell people about it would be good idea.

Instead of changing the defaultacl file (which will be overwritten by the next upgrade), you can go into the Webmin Users module, click on Global ACL next to the admin user and change the 'Can make RPC calls?' option to No. I wouldn't want to change the defaultacl file in the standard webmin distribution, as this would stop RPC from working unless it was explicitly allowed.